Two named model slots. Traffic always goes to the live slot. Swap atomically — instant cutover, instant rollback.